https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 07:33:59 +0000 https://db.gcve.eu/vuln/cve-2026-92829 <p><strong>Affected:</strong> pr-gateway Blog2Social: Social Media Auto Post &amp; Scheduler</p> <p>The Blog2Social: Social Media Auto Post &amp; Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users&#39; Blog2Social records, including disclosing another user&#39;s network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user&#39;s social-network authorization, and mass-hiding all users&#39; scheduled posts sitewide. The plugin&#39;s b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above.</p> <p><strong>Affected:</strong> pr-gateway Blog2Social: Social Media Auto Post &amp; Scheduler</p> <p>The Blog2Social: Social Media Auto Post &amp; Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users&#39; Blog2Social records, including disclosing another user&#39;s network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user&#39;s social-network authorization, and mass-hiding all users&#39; scheduled posts sitewide. The plugin&#39;s b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above.</p> https://db.gcve.eu/vuln/cve-2026-92829